Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: unbound (UTSA-2026-104820)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104820 advisory. In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip'...

Linux Distros Unpatched Vulnerability : CVE-2026-74750

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ovpn: defer key slot crypto freeing to workqueue Key slots are released through a kref and the existing release path frees the AEAD transforms from an RCU...

Linux Distros Unpatched Vulnerability : CVE-2026-80556

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mmc: atmel-mci: Fix use-after-free in atmciremove due to race condition In atmciprobe, &host-bhwork is bound with atmciworkfunc, and atmciinterrupt,...

EUVD-2026-66700

The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql parameter is stored in the treportsqlresource table through the ReportController.save interface and directly embedded into Hibernate native queries without any parameterization or...

Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104

This module enables users to display a field of a target entity through a Blazy Filter plugin shortcode. The module does not consistently check entity view access. If a user has access to a Blazy-enabled text format, this allows them to render a field from an entity they are not permitted to view...

CVE-2026-75334

The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql parameter is stored in the treportsqlresource table through the ReportController.save interface and directly embedded into Hibernate native queries without any parameterization or...

PT-2026-82080

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3 Description The tgrep module contains a regular expression denial of service ReDoS issue. The tgrep node action function compiles user-supplied regular expressions within /regex/ pattern nodes and executes them...

PT-2026-82371

Name of the Vulnerable Software and Affected Versions CAPTCHA Protected Page versions 0.0.0 through 1.0.2 Description An authentication bypass exists in the CAPTCHA Protected Page module, which allows site administrators to require CAPTCHA confirmation on specific pages. The module fails to...

PT-2026-82374

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Two distinct issues were identified. First, a module designed to restrict access to the /user/login endpoint via a secret key fails to invalidate relevant caches...

PT-2026-82172

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the atmel-mci driver due to a race condition in the atmci remove function. The &host-bh work variable is bound to the atmci work func function and can be...

Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

This module enables you to create one or more multisites with highly granular page permissions. The module doesn't sufficiently sanitize HTML code contained in the page name when displayed in the built-in tree browser. This results in a cross-site scripting vulnerability that may allow attackers ...

Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117

Slick UI, a sub-module of Slick, enables you to add Slick option sets that may contain HTML for carousel buttons. Previous releases of the module did not sufficiently validate user input, leading to a Cross Site Scripting XSS vulnerability. Note: This vulnerability was fixed in 8.x-2.1 but that w...

CVE-2026-75411

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the SecurityCheck class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely...

CVE-2026-75334

The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql parameter is stored in the treportsqlresource table through the ReportController.save interface and directly embedded into Hibernate native queries without any parameterization or...

CVE-2026-75330: Improper Neutralization of Special Elements used in an SQL Command

The front-end interface /superdiamond/preview/projectCode/module/type of super-diamond-server = 1.3.3 is vulnerable to SQL injection. The module parameter is directly concatenated into the SQL IN clause through StringUtils.split and string concatenation without being parameterized and bound...

PT-2026-82130

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ovpn module where key slots are released through a kref, and the release path frees AEAD Authenticated Encryption with Associated Data transforms from an RCU...

The vulnerability of the pn532_receive_buf() function in the drivers/nfc/pn533/uart.c module of the Linux NFC kernel driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the pn532receivebuf function in the drivers/nfc/pn533/uart.c file of the Linux NFC driver module is related to the copying of buffers without checking the size of the input data a classic buffer overflow attack. Exploiting this vulnerability could allow an attacker to...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: perl-Encode (UTSA-2026-093243)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093243 advisory. Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library in the current working directo...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098711)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098711 advisory. In the Linux kernel, the following vulnerability has been resolved: atm: lec: fix null-ptr-deref in lecarpclearvccs syzkaller reported a null-ptr-deref in...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098944)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098944 advisory. In the Linux kernel, the following vulnerability has been resolved: module: Fix kernel panic when a symbol stshndx is out of bounds The module loader doesn't check...